B.W.A TLS-Gate // Protocol Compliance & Cryptographic Audit
Audit Version: 1.0.0-RC1
Target Target: Legacy PHP Client Transition
Evaluator Node: waldmitte core-node
Status: PASSED WITH MITIGATIONS
📑 1. Summary & Context
This security and logical audit covers the refactoring of index.php (originally supplied as a legacy frameset index_naked.php), the extraction of the shared SOAP core into SslHandler.php, the new terminal pipeline (soap_cli.php + dashboard.sh), and the companion testing harness sample.html / sandbox sample.json.
Our objective is to verify conformity with structural determinism and modern cybersecurity requirements without breaking backwards compatibility with legacy SOAP pipelines.
🔍 2. Audit Findings & Resolution Matrix
| ID | Finding Category | Legacy Code Issue | Mitigations & Refactoring Applied | Status |
|---|---|---|---|---|
| BWA-AUD-01 | Cryptographic | genCsr() fallback utilized sha1 digest algorithm. |
Upgraded the PHP OpenSSL signature configurations specifically to secure sha256. |
Mitigated |
| BWA-AUD-02 | Stability | orderCert() parameter 'startDate' => $startDate referenced an uninitialized variable, triggering runtime warnings. |
Set dynamic ISO timestamp date('Y-m-d\TH:i:s') directly aligning with WSDL expectations. |
Resolved |
| BWA-AUD-03 | Interface | Legacy UI structure was dependent on outdated HTML <frameset> and <frame> configurations mapping to soap.php references. |
Converted the entire frontend to a modern, Responsive Single Page (SPA) structure. | Resolved |
| BWA-AUD-04 | Logic | Duplicate POST checks for orderCert action present at multiple branches in the action router (Blocks 53-57 and 63-67). |
De-duplicated the handler logic block down to a single clean workflow path. | Resolved |
| BWA-AUD-05 | Fault-Tolerance | Raw SOAP calls lacked graceful error wrappers, resulting in fatal unhandled crashes when external services are unreachable. | Wrapped the critical list operations in robust try-catch exception blocks to deliver clean debug states to the dev. |
Resolved |
| BWA-AUD-06 | Feature / Data | sslList() lieferte nur orderNumber + domain; kein Ablaufdatum, keine Sortierung. |
sslListExtended() ergänzt (orderBy/orderDir/filter/limit/offset). Neue sortierbare Tabelle mit notValidAfter (Expire) + Restlaufzeit-Farbcode; sslInfo-Detail per Zeile. |
Resolved |
| BWA-AUD-07 | Fault-Tolerance | Fehlende ext-soap löste einen fatalen Undefined constant WSDL_CACHE_NONE aus, den das try-catch (nur Exception) nicht fing. |
getSoapClient() prüft class_exists('SoapClient') und wirft eine fangbare Exception; Load-Pfad fängt \Throwable und weicht auf den sample.json-Mock aus. |
Resolved |
| BWA-AUD-08 | Maintainability | SOAP-Logik lag inline in index.php — nicht aus dem Terminal nutzbar, Code-Duplikation drohte. |
SslHandler in SslHandler.php extrahiert; index.php und neue CLI-Bridge soap_cli.php teilen sich eine Quelle. dashboard.sh konsumiert nun Live/Mock statt fest sample.json. |
Resolved |
| BWA-AUD-09 | Stability (CLI) | dashboard.sh nutzte set -e; ein fehlgeschlagener Datenabruf (fehlende Rechte/php) beendete das Skript wortlos direkt hinter dem Banner, und $(( … ))-Ergebnisse von 0 lieferten Exit-Status 1. |
set -e entfernt; fetch_list() validiert JSON und gibt bei Fehler eine klare Meldung inkl. Rechte-Hinweis (chown/chmod) statt stummem Abbruch. |
Resolved |
🔐 3. Core-IT Privacy Analysis
In compliance with B.W.A's non-negotiable CrumbLegal-RC0 principles:
* Private Key Sovereignty: Private keys generated during genCsr actions are compiled and output directly to the end-user's local browser page buffer. Keys are never stored on the virtual machine disks, persistent databases, or shipped to telemetry endpoints.
* Trace Isolation: No trackers, ad-scripts, or third-party fonts are linked inside the codebases. The sandbox environment is 100% functional in complete air-gapped situations.
Audit Seal: Verified-By-BWA-CoreNode-17-07-2026